1. Hem-Ogi 2.1: One Way Functions GEM Group 2: Benjamin Van Durme Pin Lu Ross Messing Shivashankar Balu Tanushree Mittal

2. 11/15/2004 CSC 486 : Hem-Ogi 2.1 Definitions One Way Functions :  A function that is easy to compute and hard to invert  There are no known functions that have been proven to be one way Much like we don’t know if P=NP …  In general, we want to say that f is one way if : f (x) = y can be computed in polynomial time, but its inverse: g (y) =x cannot be computed in polynomial time

3. 11/15/2004 CSC 486 : Hem-Ogi 2.1 Definition 2.1 : Honesty Honesty :  We say a function f, is honest if Honesty says that for each element x where f (x) is defined, the length of the result, y, is at most polynomially longer than the length of x Why do we need this? We are trying to prevent “cheating” by allowing someone to claim that the inverse is not “easy” because it takes more than polynomial time to write the output

4. 11/15/2004 CSC 486 : Hem-Ogi 2.1 Example of Honesty Consider the function f (x) =  The output is so short relative to the input that it will take triple exponential time to write the inverse  Thus, f is polynomial time computable, but not polynomial time invertible naively, this would seem to be a one way function  However, the “non-easy” invertibility of f is only due to a “cheap trick” where we’ve forced the inversion function to spend all of its time simply writing the result That’s not fair!  We preclude these types of functions by requiring all those that are “truly” one way to be HONEST

5. 11/15/2004 CSC 486 : Hem-Ogi 2.1 Definition 2.2 : Poly time invertible A function f is polynomial-time invertible if there is a polynomial-time computable function g such that : Which is just to say that f can be “reversed engineered” in a somewhat similar amount of time

6. 11/15/2004 CSC 486 : Hem-Ogi 2.1 Definition 2.3 : One way A function f is one way if :  f is polynomial-time computable, and  f is not polynomial time invertible, and  f is honest

7. 11/15/2004 CSC 486 : Hem-Ogi 2.1 Definition 2.4 : One to one A function f :  * !  * is one to one if: ( 8 y 2  * ) [ ||f x | f ( x ) = y g|| · 1 ]

8. 11/15/2004 CSC 486 : Hem-Ogi 2.1 Theorem 2.5 1. One-way functions exist iff P  NP 2. One-to-one one-way functions exist iff P  UP  We will be spending the rest of class proving these two points. The proof for the second point is a modification of the first, so pay close attention to the details, as we’ll be glossing over some things the second time around.

9. 11/15/2004 CSC 486 : Hem-Ogi 2.1 Proof : One way functions exist iff P  NP Breaking this up, we get:  if : P  NP ) one way functions exist  only if : One way functions exist ) P  NP We will now tackle this in two stages, proving each direction as a separate sub-proof

10. 11/15/2004 CSC 486 : Hem-Ogi 2.1 Proof : P  NP ) one way functions exist We are going to assume “ P is not equal to NP” Now imagine a non-deterministic, polynomial- time computable Turing machine (NPTM) N, where L(N) = A Let A be in NP-P  P does not equal NP, so this set exists

11. 11/15/2004 CSC 486 : Hem-Ogi 2.1 Proof… the function f Let h¢,¢i be our standard pairing function  For reference, this is polynomial time computable and invertible Now, consider an arbitrary function f that takes as input the paired values h x,w i  f is polynomial time computable It just has to verify that w is an accepting path for x  f is also honest Why?

12. 11/15/2004 CSC 486 : Hem-Ogi 2.1 Proof… f is honest When w represents an accepting path of an NPTM when run on x, then we know that no path in such a machine can be longer than some polynomial p(| x| ) When w does not represent such a path, then we have no a priori knowledge as to the length of w; indeed, |w| could be super-exponential in the length of x  This could spell trouble for f’ s honesty However, all values of w such that | w|> p( |x| ) will lead f to output 1 x Note that since we can only define f if we already have some machine N, then we “get to” set the polynomial bound used to keep f honest with full knowledge as to the polynomial bound constraining N  While both polynomials must be with respect to essentially the same string ( x vs 1x ), we have the right to make the honesty bound polynomially larger than the bound on N  This means that there is at least one value of w that will be “too long” to be an accepting path, but is still “short enough” to allow f to fulfill the honesty condition  As we only need at least one honest preimage for every output, then this solves our concern about w  This is a form of out-flanking So, whether or not w is an accepting path, h x,w i is still just a polynomial expansion away from x ¢ w, which is itself polynomial in length with respect to x (specifically, this is true for at least one w for each output of f ) The range of f is : f 0x, 1x g  |x| + |0| = |x| + 1 So, given these facts, is it true that | h x,w i | · q(|0x|) ?  Of course it is Therefore, f is honest

13. 11/15/2004 CSC 486 : Hem-Ogi 2.1 Proof… assume f can be easily inverted Now we assume f is polynomial time invertible via some function g Given this function g, we can use it to construct a Deterministic PTM M, such that L(M) = A  Earlier we said that L(N)=A

14. 11/15/2004 CSC 486 : Hem-Ogi 2.1 Proof… the machine M The machine M on arbitrary input x :  Check if 0x is in the domain of g If not, then reject  Otherwise Call g(0x), which will return some value h x,w i Test whether w is an accepting path of N( x )  If yes, then accept Otherwise reject

15. 11/15/2004 CSC 486 : Hem-Ogi 2.1 Proof… what does M buy us? With M in hand, we can conclude that A must belong to P  because we just gave a DPTM that accepts A But wait:  Earlier we assumed that A was not in P  We did this by stating that A was in NP-P  A cannot be in both P and NP-P  Contradiction

16. 11/15/2004 CSC 486 : Hem-Ogi 2.1 Proof… what went wrong? The existence of M was entirely based on our assumption that g exists Therefore f must actually not be polynomial time invertible This makes f a one way function by our definition Therefore:

17. 11/15/2004 CSC 486 : Hem-Ogi 2.1 Proof: One way functions exist ) P  NP We now prove the other direction. Consider the following language: L=L= f h z, pre i | ( 9 y ) [| y|+| pre | · p(| z| ) Æ f ( pre ¢ y ) = z ] g We claim that L is clearly in NP.  Why ?

18. 11/15/2004 CSC 486 : Hem-Ogi 2.1 Proof… L 2 NP Imagine a NPTM N, such that on arbitrary input h z, pre i :  For each string y 2  *, where |y| + | pre | · p ( |z| ) Check if f (pre ¢ y ) = z Polynomial time Non-deterministic poly time 2 p ( |z| ) number of y ’s, but can be “guessed” in parallel

19. 11/15/2004 CSC 486 : Hem-Ogi 2.1 Proof… assume L 2 P Now that we’ve shown L to be in NP, we are going to assume that L 2 P  Obviously we are setting ourselves up for a contradiction We are going to use this assumption to construct a machine that will allow us to “easily” invert f, via a prefix search First, let M be a DPTM that accepts L  Note that we don’t care how it actually works, we just need to know that it exists  Using M, we can construct a new machine M’ that, on arbitrary input z, does the following…

20. 11/15/2004 CSC 486 : Hem-Ogi 2.1 Proof… the machine M’ 1.Simulate M on h z,  i :  if M rejects, then M’ rejects  if f (  )  z  then M’ accepts 2.Otherwise, let x =  3.Simulate M on h z,x0 i :  if it accepts let x = x0 if f(x) = z then M’ accepts else repeat 3  else goto 4 4.Simulate M on h z,x1 i :  if it accepts let x = x1 if f(x) = z then M’ accepts else goto 3  else goto 3 Note that we do not actually need to simulate M at this step, nor will we ever encounter the final goto (Can you tell why?)

21. 11/15/2004 CSC 486 : Hem-Ogi 2.1 0 1 1 0 0 1 Lets say f ( 011 ) = z and f ( 110 ) = z Example Accept 1 0 0 1

22. 11/15/2004 CSC 486 : Hem-Ogi 2.1 Proof… we find a contradiction With the machine M’ in hand, we can “easily” invert f  M’ will find one bit of information with each step  Because f is honest, the inverse of f(z) has to be polynomial with respect to z  Therefore, M’ will find the inverse of f(z) in polynomial time, bit by bit However, if we can easily invert f, then f can’t possibly be one-way f being a one-way function was one of our basic assumptions  CONTRADICTION

23. 11/15/2004 CSC 486 : Hem-Ogi 2.1 Proof… the fallout As f has to remain one-way, M’ must not really exist M’ existed by virtue of M M existed because we assumed L 2 P Therefore, as L is in NP, but now cannot be in P, then it must be in NP-P We have achieved our goal:

24. 11/15/2004 CSC 486 : Hem-Ogi 2.1 Proof : One way functions exist iff P  NP Thus, we have just proven part 1 of Thm 2.5

25. 11/15/2004 CSC 486 : Hem-Ogi 2.1 Proof of Second Point: One-to-one one way functions exist iff P  UP Before we tackle this proof, what is UP ?

26. 11/15/2004 CSC 486 : Hem-Ogi 2.1 UP It is the class of problems that have a unique witness. A language L is in UP if  If an NP machine N accepts an input x in language L  And, for all such input x, the computation N(x) has at most one accepting path Formally: UP = f L | there is a NPTM N such that L = L(N) and, for all x, N(x) has at most one accepting pathg

27. 11/15/2004 CSC 486 : Hem-Ogi 2.1 Proof… break up the bi-conditional As before, we will tackle each direction separately  if : P  UP ) one-to-one one way functions exist  only if : One-to-one one way functions exist ) P  UP

28. 11/15/2004 CSC 486 : Hem-Ogi 2.1 Proof : P  UP ) one-to-one one way functions exist Let A be a language in UP-P Imagine a NPTM N, where L(N) = A Consider the revised function f : Note how we’ve changed f

29. 11/15/2004 CSC 486 : Hem-Ogi 2.1 Proof… Our revised f is now clearly one-to-one  Since the non-accepting witnesses give unique results  There is only one accepting path, thus we do not need to “rig” 0x to make it unique Just as in the last proof, we can again try to assume there is a polynomial time inverse function g Using g, we can construct a similar DPTM M  The one-to-one-ness of f does not change the character of the machine

30. 11/15/2004 CSC 486 : Hem-Ogi 2.1 Proof… the machine M The machine M on arbitrary input x :  Check if 0x is in the domain of g If not, then reject  Otherwise Call g(0x), which will return some value h x,w i Test whether w is an accepting path of N( x )  If yes, then accept Otherwise reject

31. 11/15/2004 CSC 486 : Hem-Ogi 2.1 Proof… what does M buy us? With M in hand, we can conclude that A must belong to P  because we just gave a DPTM that accepts A But wait:  Earlier we assumed that A was not in P  We did this by stating that A was in UP-P  A cannot be in both P and UP-P  Contradiction

32. 11/15/2004 CSC 486 : Hem-Ogi 2.1 Proof : One-to-one one way functions exist ) P  UP Recall what we did for P  NP Consider the language: L=L= f h z, pre i | ( 9 y ) [| y|+| pre | · p(| z| ) Æ f ( pre ¢ y ) = z ] g L is obviously in UP if f is one-to-one We can try to claim that it is in P But this will fail to the same prefix search technique that we explained earlier for P  NP  One distinction: there will never be a case where both x0 and x1 could be accepted at the same level, as the prefix at every intermediate length must be unique since f is one-to-one

33. 11/15/2004 CSC 486 : Hem-Ogi 2.1 Proof… contradiction As L is in UP, but cannot be in P, then it must be the case that P  UP This gives us our result: One-to-one one way functions exist ) P  UP We have (quickly) shown both directions of the bi-conditional Thus we’ve proven point 2 of Thm. 2.5

34. 11/15/2004 CSC 486 : Hem-Ogi 2.1 Conclusion We have provided an introduction to the notion of (one-to-one), one way functions Key points to take away:  There are no known one-way functions  Their existence is tied to whether P=NP  In the case of 1-to-one one way functions, their existence is tied to a more strongly regulated version of NP, the class UP In the next lecture we will expand this last statement to cover a constant bounded version of UP

35. Hem-Ogi 2.2 : Unambiguous One Way Functions exist, bounded ambiguity one way functions exist Group 2: Benjamin Van Durme Pin Lu Ross Messing Shivashankar Balu Tanushree Mittal

36. 11/15/2004 CSC 486 : Hem-Ogi 2.1 Last lecture One Way Functions  One way functions exist, P  NP  One-to-one one-way functions exist, P  UP

37. 11/15/2004 CSC 486 : Hem-Ogi 2.1 Today’s lecture We will be expanding our last claim made previously dealing with one-to-one, one way functions and the class UP  Extend this statement to handle a slightly broader class First need cover new definitions:  k -to-one / bounded ambiguity  UP · k Then onto an inductive proof Any time left will be spent going over definitions required for the final section of Chapter 2 If we *still* have time left, I will speak on the issues raised by Lane from Monday’s lecture

38. 11/15/2004 CSC 486 : Hem-Ogi 2.1 Definition 2.6: k -to-one functions A function f is k -to-one : ( 8 y 2 range( f )) [k f x j f ( x ) = y g k · k ] If there is a k 2f 1,2,3,… g such that f is k –to- one, then we say that f is of bounded ambiguity  Special case: when k = 1 then f is said to be unambiguous

39. 11/15/2004 CSC 486 : Hem-Ogi 2.1 Thm 2.7: Unambiguous one way functions exist, bounded ambiguity one way functions exist Breaking this up, we get:  if: Bounded ambiguity one way functions exist ) Unambiguous one way functions exist  only if: Unambiguous one way functions exist ) Bounded ambiguity one way functions exist

40. 11/15/2004 CSC 486 : Hem-Ogi 2.1 Proof: Unambiguous one way functions exist ) Bounded ambiguity one way functions exist This turns out to be trivial Unambiguous one way functions are simply a special case of bounded ambiguity one way functions : ( 8 y ) 2 range ( f ) k [ f x j f ( x ) = y g · k ]  When k= 1, then f is a one-to-one (unambiguous) function Thus we’ve (quickly) shown the “only if” direction

41. 11/15/2004 CSC 486 : Hem-Ogi 2.1 Proof: Bounded ambiguity function exist ) Unambiguous one way functions exist Before beginning with the other half of the bi-conditional, we should make sure we understand the class of languages UP · k

42. 11/15/2004 CSC 486 : Hem-Ogi 2.1 UP · k A language L is in UP · k if there is a NPTM N such that:  ( 8 x 2 L ) [ N ( x ) has at least one and at most k accepting paths ]  ( 8 x 2 L c ) [ N ( x ) has no accepting paths ] Similar to UP, only rather than the associated machine being restricted to having a unique accepting path, in this case there may be up to some constant number of such paths

43. 11/15/2004 CSC 486 : Hem-Ogi 2.1 Proof… strategy for indirect proof Proving the “if” will be done using an indirect path Observe the following diagram: We implicitly use the second point of Thm 2.5 The bounded version of this point is analogous, and we thus will rely on it as a “Fact” From there we will use an inductive proof to show that P = UP ) P = UP · k At this point we rely on the contrapositive of this statement to complete the indirect attack Bounded ambiguity one way function exists Unambiguous one way function exists P  UP · k P  UP m ( m (

44. 11/15/2004 CSC 486 : Hem-Ogi 2.1 Proof… Fact 2.9 For each k ¸ 2, k -to-one one-way functions exist, P  UP · k This proof runs as that used for the second point of Theorem 2.5 (last class)

45. 11/15/2004 CSC 486 : Hem-Ogi 2.1 0 1 1 0 0 1 Lets say f ( 011 ) = z and f ( 110 ) = z Recall from Monday’s lecture that one-to-one (unambiguous) one-way functions exist, P  UP Accept 1 0 0 1

46. 11/15/2004 CSC 486 : Hem-Ogi 2.1 Proof… We will now prove by induction that, 8 k 2 f 1, 2, 3 … g : P = UP ) P = UP · k

47. 11/15/2004 CSC 486 : Hem-Ogi 2.1 Proof… base case Our base case is when k = 1 When k = 1, then UP · k = UP · 1  Because UP · 1 = UP Therefore:  P = UP ) P = UP · 1 Now to handle larger values of k …

48. 11/15/2004 CSC 486 : Hem-Ogi 2.1 Proof… frame the inductive step First assume that we have:  P = UP ) P = UP · k’ Now use this to show that:  P = UP ) P = UP · k’+1

49. 11/15/2004 CSC 486 : Hem-Ogi 2.1 Proof: P = UP ) P = UP · k’+ 1 Assume P = UP Let L be a arbitrary member of UP · k’ + 1 This means there is a NPTM N where:  L = L ( N )  N has at most k’ + 1 accepting paths

50. 11/15/2004 CSC 486 : Hem-Ogi 2.1 Proof… Consider the following language: B = f x | N ( x ) has exactly k’ + 1 accepting paths g Perhaps not so clearly, B 2 UP  Why?

51. 11/15/2004 CSC 486 : Hem-Ogi 2.1 B 2 UP Let N B be a NPTM such that L ( N B ) = B N B ( x ) is going to guess various paths N ( x ) might take  Each guess will each contain exactly k’+ 1 paths of N ( x ) Just because that is how we are defining the machine: a guess contains k’+ 1 elements  The paths contained in each guess will be arranged lexicographically (“uniquely sorted”) This means that no two guesses will contain exactly the same set of paths  For each guess, N B ( x ) verifies whether each of the k’+ 1 paths are accepting paths  Only if all k’+ 1 paths in a given guess “check out” will N B ( x ) accept As we said, no two guesses by N B ( x ) will consider exactly the same set of paths As the guesses contain exactly k’+ 1 paths, and there are only k’+ 1 accepting paths in N ( x ), then there will be at most one guess that leads N B ( x ) to accept Note that in the cases where there are not k’+ 1 accepting paths in N ( x ), then it can only be the case that there are strictly less than this many accepting paths  In these cases N B ( x ) will reject, as the guess is hard-coded at k’+ 1 and every path in the guess must be an accepting one for N B ( x ) to accept This means that B 2 UP

52. 11/15/2004 CSC 486 : Hem-Ogi 2.1 Proof… We assumed that P = UP Therefore, as B 2 UP then B 2 P This means that there must be a deterministic algorithm for deciding membership in B

53. 11/15/2004 CSC 486 : Hem-Ogi 2.1 Proof… Consider the language: D = f x j x 62 B Æ x 2 L ( N ) g N D ( x ) :  Simulate M B ( x ) If M B ( x ) accepts, then N D ( x ) rejects (ie there are exactly k’+ 1 accepting paths)  Otherwise Simulate N ( x ) Accept if a given path of N ( x ) accepts Otherwise reject Note that this exists as B 2 P

54. 11/15/2004 CSC 486 : Hem-Ogi 2.1 Proof… N D ( x ) has k ’ or less accepting paths Therefore D 2 UP · k’ As we assumed:  P = UP ) P = UP · k ’ And since D 2 UP · k’ Then it must be the case that D 2 P

55. 11/15/2004 CSC 486 : Hem-Ogi 2.1 Proof… P is closed under union At this point we have: B 2 PB 2 P D 2 PD 2 P Now recall that P is closed under union This means that B [ D 2 P

56. 11/15/2004 CSC 486 : Hem-Ogi 2.1 Proof… B [ D = L B [ D contains all those x ’s such that, for a given x :  N ( x ) has exactly k’ + 1 accepting paths, or  N ( x ) has at least one and at most k’ accepting paths But this means that B [ D = L  L was our arbitrarily chosen language from UP · k’+ 1 As both B and D are in P, then the following must hold:  B [ D = L 2 P

57. 11/15/2004 CSC 486 : Hem-Ogi 2.1 Proof… inductive proof completed If L 2 P under our assumptions then : P = UP ) P = UP · k’ + 1 This was our inductive step Which means we can conclude: P = UP ) P = UP · k

58. 11/15/2004 CSC 486 : Hem-Ogi 2.1 Proof… recalling our mission We are trying to show that the existence of unambiguous one way functions is explicitly tied to the existence of bounded ambiguity one-to-one functions We broke up the if-and-only-if to see that one direction was trivial, while the other direction involved a round-about path: Bounded ambiguity one way function exists Unambiguous one way function exists P  UP · k P  UP m ( m,

59. 11/15/2004 CSC 486 : Hem-Ogi 2.1 Proof… recalling our mission We are trying to show that the existence of unambiguous one way functions is explicitly tied to the existence of bounded ambiguity one-to-one functions We broke up the if-and-only-if to see that one direction was trivial, while the other direction involved a round-about path: Bounded ambiguity one way function exists Unambiguous one way function exists P  UP · k P  UP m ( m ( We proved this last class We get this through indirection We just finished proving the contrapositive of this This comes from Fact 2.9 ) This is the trivial direction we started with, This is what we were going for

60. 11/15/2004 CSC 486 : Hem-Ogi 2.1 Proof… we are done This means that we have finished the proof: Theorem 2.7  Unambiguous one way functions exist, bounded ambiguity one way functions exist

61. 11/15/2004 CSC 486 : Hem-Ogi 2.1 Summary Key take aways:  On Monday we showed that: The existence of one-to-one one way functions are tied to whether the language class P equals UP  Today we showed a stronger version: k -to-one one way functions exist iff P  UP · k  In addition, we showed that 1 -to-one one way functions exist iff k -to-one one way functions exist Certainly an interesting fact! At this point we will move on to section 2.3 of the textbook, in order to provide a first glimpse of the required definitions

62. 11/15/2004 CSC 486 : Hem-Ogi 2.1 Definition 2.10: Honesty A 2-ary function f :  * £  * !  * is honest if ( 9 polynomial q ) ( 8 y 2 range( f )) ( 9 x, x’ ) [ j x j + j x’ j · q ( j y j ) Æ f ( x, x’ ) = y ] Informally:  A 2-ary function f is honest if there's a polynomial p such that p ( j f ’s output j ) is greater than the sum of the length of both inputs

63. 11/15/2004 CSC 486 : Hem-Ogi 2.1 Defn 2.11: polynomial time invertible A 2-ary function f :  * £  * !  * is polynomial time invertible if there is a polynomial time computable function g such that, for every y 2 range( f ) : y 2 domain( g ) Æ (first( g ( y )),second( g ( y ))) 2 domain( f ) Æ f (first( g ( y )),second( g ( y ))) = y, where the project functions first( z ) and second( z ) denote, respectively, the first and second components of the unique ordered pair of strings that, when paired, give z

64. 11/15/2004 CSC 486 : Hem-Ogi 2.1 Defn 2.12: One way function A 2-ary function f :  * £  * !  * is one-way if  f is polynomial time computable  f is not polynomial time invertible and  f is honest

65. 11/15/2004 CSC 486 : Hem-Ogi 2.1 Defn 2.13: s-honest A 2-ary function f :  * £  * !  * is s -honest if  (9 polynomial q ) ( 8 y, a : ( 9 b )[ f ( a, b ) = y ]) ( 9 b ’ ) [ j b ’ j · q ( j y j + j a j ) Æ f ( a, b ’) = y ].  (9 polynomial q ) ( 8 y, b : ( 9 a )[ f ( a, b ) = y ]) ( 9 a ’) [ j a ’ j · q ( j y j + j b j ) Æ f ( a ’, b ) = y ].

66. 11/15/2004 CSC 486 : Hem-Ogi 2.1 Defn: 2.14 strongly non invertible A 2-ary function f :  * £  * !  * is strongly- noninvertible if it is s-honest and yet neither of the following conditions holds:  There is a polynomial-time computable function g :  * £  * !  * such that ( 8 y 2 range( f )) ( 8 x 1, x 2 :( x 1, x 2 ) 2 domain( f ) Æ f ( x 1, x 2 ) = y ) [ ( y, x 1 ) 2 domain( g ) Æ f ( x 1, g ( y, x 1 )) = y ]  There is a polynomial-time computable function g :  * £  * !  * such that ( 8 y 2 range( f )) ( 8 x 1, x 2 : ( x 1, x 2 ) 2 domain( f ) Æ f ( x 1, x 2 ) = y ) [ ( y, x 2 ) 2 domain( g ) Æ f ( g ( y, x 2 ), x 1 ) = y ]

67. 11/15/2004 CSC 486 : Hem-Ogi 2.1 Defn: 2.14 strongly non invertible contd… A 2-ary function is strongly non-invertible if, even given one of it's inputs and it's output, the other input cannot be computed in polynomial time.

68. 11/15/2004 CSC 486 : Hem-Ogi 2.1 Defn: 2.15: Associativity & commutativity A total, 2-ary function f:  * £  * !  * is associative if: ( 8 x, y, z ) [f (f( x, y ), z ) = f( x,f( y, z ))] A total, 2-ary function f:  * £  * !  * is commutative if: ( 8 x, y ) [f( x, y ) = f( y, x )]

69. 11/15/2004 CSC 486 : Hem-Ogi 2.1 Theorem 2.16: One-way functions exist if and only if strongly noninvertible, total, commutative, associative, 2-ary one way functions exist

70. Hem-Ogi 2.3 : One-way functions exist, strongly noninvertible, total, commutative, associative, 2-ary one-way functions exist Group 2: Ben Van Durme Pin Lu Ross Messing Shiva Shankar Balu Tanushree Mittal

71. 11/15/2004 CSC 486 : Hem-Ogi 2.1 Definition 2.10: Honesty A 2-ary function f :  * £  * !  * is honest if ( 9 polynomial q ) ( 8 y 2 range( f )) ( 9 x, x’ ) [ j x j + j x’ j · q ( j y j ) Æ f ( x, x’ ) = y ] Informally:  A 2-ary function f is honest if there's a polynomial p such that p ( j f ’s output j ) is greater than the sum of the length of two arguments which give that output

72. 11/15/2004 CSC 486 : Hem-Ogi 2.1 Defn 2.11: polynomial time invertible A 2-ary function f :  * £  * !  * is polynomial time invertible if there is a polynomial time computable function g such that, for every y 2 range( f ) : y 2 domain( g ) Æ (first( g ( y )),second( g ( y ))) 2 domain( f ) Æ f (first( g ( y )),second( g ( y ))) = y, where the functions first( z ) and second( z ) denote, respectively, the first and second components of the ordered pair of strings that can be paired to form z

73. 11/15/2004 CSC 486 : Hem-Ogi 2.1 Defn 2.12: One way function A 2-ary function f :  * £  * !  * is one-way if  f is polynomial time computable  f is not polynomial time invertible and  f is honest

74. 11/15/2004 CSC 486 : Hem-Ogi 2.1 Defn 2.13: s-honest A 2-ary function f :  * £  * !  * is s -honest if  (9 polynomial q ) ( 8 y, a : ( 9 b )[ f ( a, b ) = y ]) ( 9 b ’ ) [ j b ’ j · q ( j y j + j a j ) Æ f ( a, b ’) = y ].  (9 polynomial q ) ( 8 y, b : ( 9 a )[ f ( a, b ) = y ]) ( 9 a ’) [ j a ’ j · q ( j y j + j b j ) Æ f ( a ’, b ) = y ]. For any y 2 f ’s range, there exists an a and b such that f (a,b) = y. We say that f is s-honest if there exists a bounding polynomial q, and an argument b’ such that q(|y|+|a|) ¸ |b’|, and f(a,b’) = f(a,b) = y.

75. 11/15/2004 CSC 486 : Hem-Ogi 2.1 Defn: 2.14 strongly noninvertible A 2-ary function f :  * £  * !  * is strongly noninvertible if it is s- honest but neither of the following conditions hold:  There is a polynomial-time computable function g :  * £  * !  * such that ( 8 y 2 range( f )) ( 8 x 1, x 2 :( x 1, x 2 ) 2 domain( f ) Æ f ( x 1, x 2 ) = y ) [ ( y, x 1 ) 2 domain( g ) Æ f ( x 1, g ( y, x 1 )) = y ]  There is a polynomial-time computable function g :  * £  * !  * such that ( 8 y 2 range( f )) ( 8 x 1, x 2 : ( x 1, x 2 ) 2 domain( f ) Æ f ( x 1, x 2 ) = y ) [ ( y, x 2 ) 2 domain( g ) Æ f ( g ( y, x 2 ), x 1 ) = y ] A 2-ary function is strongly noninvertible if, even given one of it's inputs and it's output, the other input cannot be computed in polynomial time.

76. 11/15/2004 CSC 486 : Hem-Ogi 2.1 Defn: 2.15: Associativity & commutativity A total, 2-ary function f:  * £  * !  * is associative if: ( 8 x, y, z ) [f (f( x, y ), z ) = f( x,f( y, z ))] A total, 2-ary function f:  * £  * !  * is commutative if: ( 8 x, y ) [f( x, y ) = f( y, x )]

77. 11/15/2004 CSC 486 : Hem-Ogi 2.1 Proposition 2.17 The following are equivalent  One-way functions exist  2-ary one-way functions exist  P  NP

78. 11/15/2004 CSC 486 : Hem-Ogi 2.1 Proof of Proposition 2.17 One-way functions exist, P  NP  See Theorem 2.5 in section 2.1 One-way functions exist, 2-ary one-way functions exist  One-way functions exist ( 2-ary one-way functions exist  One-way functions exist ) 2-ary one-way functions exist

79. 11/15/2004 CSC 486 : Hem-Ogi 2.1 One-way functions exist ( 2-ary one-way functions exist One-way functions exist if 2-ary one-way functions exist  Let f be any 2-ary one-way function, and define g as g(x) = f(first(x), second(x)) where first(x) and second(x) respectively denote the first and second component of the unique pair mapping to x by the pairing function  Clearly, g is one-way function. x = h first(x), second(x) i One to One

80. 11/15/2004 CSC 486 : Hem-Ogi 2.1 One-way functions exist ) 2-ary one-way functions exist One-way functions exist only if 2-ary one-way functions exist  Let h be any one-way function. Define h’: h’(x, y) = h h(x), y i. Then h’ is an obvious 2-ary one-way function Or h’’(x, y) = h h(x), h(y) i. Then h’’ is also a 2-ary one-way function, but with strong noninvertibility (see Definition 2.14)

81. 11/15/2004 CSC 486 : Hem-Ogi 2.1 Theorem 2.16 One-way functions exist, strongly noninvertible, total, commutative, associative, 2-ary one-way functions exist.

82. 11/15/2004 CSC 486 : Hem-Ogi 2.1 Proof : if direction of Theorem 2.16 If  By Proposition 2.17, one-way functions exist, 2-ary one- way functions exist  Strongly noninvertible, total, commutative, associative, 2- ary one-way functions exist ) 2-ary one-way functions exist  Therefore, strongly noninvertible, total, commutative, associative, 2-ary one-way functions exist ) One-way functions exist Strongly noninvertible, total, commutative, associative, 2-ary one-way functions

83. 11/15/2004 CSC 486 : Hem-Ogi 2.1 Proof : only if direction of Theorem 2.16 only if  By proposition 2.17, we have P  NP, One-way functions exist, 2-ary one-way functions exist  To prove the goal that One-way functions exist ) strongly noninvertible, total, commutative, associative, 2-ary one-way functions exist, we can equivalently show P  NP ) strongly noninvertible, total, commutative, associative, 2-ary one-way functions exist

84. 11/15/2004 CSC 486 : Hem-Ogi 2.1 Proof : only if direction of Theorem 2.16 P  NP ) strongly noninvertible, total, commutative, associative, 2-ary one-way functions exist  By the premise that P  NP, then there exists a NPTM N’ such that L(N’) 2 NP - P  By a Standard Machine Manipulation, there exists a polynomial p and a NPTM N such that L(N) = L(N’) and 8 x the computation paths of N(x) have exactly p(|x|) bits How do we do this Standard Machine Manipulation?

85. 11/15/2004 CSC 486 : Hem-Ogi 2.1 Standard Machine Manipulation  We construct N as follows: First, we construct a polynomial q, such that q(x)=Max( p’(x), x+1), where p’ where p’ refers to the polynomial time bound for N’. As N’(x ) runs, we count the number of nondeterministic guesses it makes, and call that m. At the end of each computation path of N’(x ), we make q(|x|) - m additional nondeterministic dummy guesses.  Therefore, for each input x, the length of any computation path of N(x) is exactly q(|x|).  Obviously, it is guaranteed that the length of each computation path is greater than the length of the input  So we have built a new NPTM N from N ’. N accepts the same language as N ’ and for each input x, the length of all computation paths of N(x) are exactly of length q(|x|), which is greater than |x|

86. 11/15/2004 CSC 486 : Hem-Ogi 2.1 Definition of Witness Definition  All computation paths are viewed as potential witnesses for x 2 L(N).  We call a path a witness for x 2 L(N) if it is an accepting path of N(x).  We define W(x) as the set of all witnesses for x 2 L(N).  Note that no string can be the witness of itself for the previously defined NPTM N, because our machine manipulation requires that the length of any computation path is greater than the length of the input.

87. 11/15/2004 CSC 486 : Hem-Ogi 2.1 Definition of the function f Now we define a function f, which we will prove to be a strongly noninvertible, total, commutative, associative, 2-ary one-way function. f(u, v) = t is any fixed string that is not in L(N)

88. 11/15/2004 CSC 486 : Hem-Ogi 2.1 Proof : f is total and polynomial-time computable f is defined over 8 (x 1, x 2 ) 2  * £  *, thus f is total f is polynomial-time computable  Pairing function is polynomial-time computable We get two pairs for two arguments of f, respectively  The string comparison is poly-time computable Test if the first elements of both arguments match  Test the second element of each pair to check if it is the witness on NPTM N of the first element of the pair. N(x) is checkable in deterministic polynomial time

89. 11/15/2004 CSC 486 : Hem-Ogi 2.1 Proof : f is commutative If the input (u, v) falls into the first case,  The commutativity of f holds, because function lexmin itself is commutative. No matter which order it’s in, the output is always h x, q i, where q is the lexicographically less of u ’s and v ’s second components f(u, v) =

90. 11/15/2004 CSC 486 : Hem-Ogi 2.1 Proof : f is commutative If the input (u, v) falls into the last two cases of f, then f(u, v) = f(v, u) holds  Case 2: If one of the arguments is the pair x 2 L(N)., and its witness w, and the other is the pair h x, x i  Case 3: Since the first two cases are commutative, if an input pair (x, y) does not fall into the first two cases, (y, x) also cannot, which means f(x, y) = f(y, x) = h t, t1 i Note that this is a set, so the order of the two arguments does not matter

91. 11/15/2004 CSC 486 : Hem-Ogi 2.1 f is s-honest  Witnesses for NPTM N are of length bounded polynomially in the length of their input string  Therefore, for the first two cases of f, when we fix one argument, the length trick cannot succeed on the other argument, since two arguments with the same first element must be no more than polynomially longer or shorter than each other.

92. 11/15/2004 CSC 486 : Hem-Ogi 2.1 f is s-honest  For the third case of f, given the output h t, t1 i and one fixed argument, we can always find another argument h a, b i whose length falls within a polynomial bound, and we can ensure that it produces the correct output by ensuring that a isn’t the same as the first element of the other argument

93. 11/15/2004 CSC 486 : Hem-Ogi 2.1 Proof : f is strongly noninvertible Assume f is not strongly noninvertible  Since we have proven that f is s-honest, strong noninvertibility must fail because at least one of the two conditions in the definition of strong noninvertibility holds. This means that given the output and one argument, the other argument can be computed in polynomial-time

94. 11/15/2004 CSC 486 : Hem-Ogi 2.1 Proof : f is strongly noninvertible Then, there exists a polynomial-time function g such that, when we consider Case 2,  If x 2 L(N), g( h x, x i, h x, x i ) should output h x, w i,where w 2 W(x) This gives us a deterministic polynomial-time algorithm to test input x ’s membership in L(N)  On input x, first compute g( h x, x i, h x, x i ), reject if the output is not of the form h x, w i  Then simulate N(x) on computation path w, accept x if N(x) accepts One argument and the outputThe other argument

95. 11/15/2004 CSC 486 : Hem-Ogi 2.1 Proof : f is strongly noninvertible But we’ve revealed a contradiction!  Remember, we’ve assumed that L(N) 2 NP-P  But now we have a deterministic polynomial-time algorithm to test membership in L(N)  Therefore, the assumption that f is not strongly noninvertible must be wrong So, f satisfies the definition of strong noninvertibility

96. 11/15/2004 CSC 486 : Hem-Ogi 2.1 Proof : f is honest It is easy to verify f is honest in Case 1 and 2  The pairing function is polynomial-time computable and invertible  The witnesses of all strings in L(N) are length-bounded by N ‘s polynomial time bounding polynomial. Furthermore, as required by our machine manipulation, 8 x 2 L(N), |w| = q(|x|), which is still polynomial  Thus, f cannot dramatically distort the length of input

97. 11/15/2004 CSC 486 : Hem-Ogi 2.1 Proof : f is honest For Case 3, we expand the honesty polynomial to cover the shortest input mapping to h t, t1 i. By the definition of honesty, we only need to guarantee there exists one input for each output whose length is polynomially bounded by each output How does it work?

98. 11/15/2004 CSC 486 : Hem-Ogi 2.1 Proof : f is honest Suppose x m = h x m ’, x m ” i is the shortest input on which f outputs h t, t1 i Honest polynomial Length

99. 11/15/2004 CSC 486 : Hem-Ogi 2.1 Proof : f is associative f is associative, For each z, z’, z” 2  *, f ( f ( z, z’), z”) = f ( z, f ( z’, z”) )

100. 11/15/2004 CSC 486 : Hem-Ogi 2.1 Some definitions As previously defined, first(z) and second(z) are the first and second elements of the pair z created by our pairing function A string a is Legal if

101. 11/15/2004 CSC 486 : Hem-Ogi 2.1 Discuss over all cases Case 1: At least two of z, z’, z” are not legal  Then, f ( f ( z, z’), z”) = f ( z, f ( z’, z”) ) = h t, t1 i Case 2: If it is not the case that first(z) = first(z’) = first(z”)  Again, f ( f ( z, z’), z”) = f ( z, f ( z’, z”) ) = h t, t1 i Case 3: if first(z) = first(z’) = first(z”) and exactly one of z, z’, z” is not legal and the one that is not legal is not of the form h first(z), first(z) i  Still, f ( f ( z, z’), z”) = f ( z, f ( z’, z”) ) = h t, t1 i

102. 11/15/2004 CSC 486 : Hem-Ogi 2.1 Discuss over all cases Case 4: if first(z) = first(z’) = first(z”) and exactly one of z, z’, z” is not legal and the one that is not legal is of the form h first(z), first(z) i  f ( f ( z, z’), z”) = f ( z, f ( z’, z”) ) = h first(z), first(z) i Case 5: if first(z) = first(z’) = first(z”) = x and all of z, z’, z” are legal  f ( f ( z, z’), z”) = f ( z, f ( z’, z”) ) = h first(z), q i, where q is the lexicographically least of second(z), second(z’), second(z”). This works because lexicographic minimum is associative.

103. 11/15/2004 CSC 486 : Hem-Ogi 2.1 Conclusion We have shown that P  NP ) f is a strongly noninvertible, total, commutative, associative, 2-ary one-way function Therefore, P  NP ) strongly noninvertible, total, commutative, associative, 2-ary one- way functions exist Theorem 2.16 is proved